Everything you need to run privacy, security and compliance
TrustNiq brings the work of the DPO, the CISO and the compliance team into one place. Systems are scanned, controls are tested on evidence, gaps are fixed and proven, and the same results feed every framework, audit, report and customer questionnaire.
Jump to: Posture · Data and assets · Assurance ·Frameworks and GRC · Audits and reports · Privacy operations ·Incidents · Vendors and trust · AI governance ·Integrations · Administration
One picture, seen four ways
The overview shows the same measured results to each audience in the terms they need. Posture is shown as counts, and anything not yet known is shown as unknown.
Views for every role
Board, CISO, DPO and auditor views of one set of results: audit readiness, regulatory clocks, privacy operations, evidence health and what changed in the last seven days.
Ask the platform
Ask in plain language, for example which systems hold Aadhaar numbers or which findings are overdue, and get an answer drawn from your own evidence with references you can open. Without an approved AI provider, it runs the closest built-in query instead.
State as of any date
Rebuild what the organisation knew on a past date, control by control, to answer an auditor or the Board about a specific day rather than about today.
Know what you have and where personal data sits
Personal data discovery
Databases are classified column by column for names, contact details, Aadhaar (checksum verified), PAN, passport, card (Luhn checked) and bank numbers. Each result carries a confidence score and its reasoning, and uncertain matches wait in a review queue. Only masked shapes are kept, never values.
Asset inventory
Cloud resources, databases, identities and repositories with their current configuration, immutable configuration snapshots, relationships, findings and the personal data they hold. Unregistered systems are flagged as shadow assets.
Privacy analysis
Data lineage from system to dataset to purpose to vendor and country; use beyond the purpose the data was collected for; what each processing activity actually needs; and who can reach personal data.
Controls tested on evidence, findings closed on proof
Automated control testing
Encryption, public exposure, MFA, dormant and privileged accounts, key rotation, log retention in India, backups, time sync, branch protection and more, re-run on a schedule. Stale evidence turns a result to unknown instead of leaving it green.
Explained findings
Each finding states what failed, why it matters, the evidence, the personal data at stake, the requirement, the owner and the fix. Severity rises with exposure and data sensitivity. A fix is accepted only when a re-test passes, and a finding reopens if the problem returns.
Exceptions with expiry
Accepted risks and compensating controls need a second person to approve, a reason and an end date. The original failing result stays on record.
Vulnerabilities in context
Import Trivy, OpenVAS or Dependency-Track results. Priority starts from CVSS and adds internet exposure, personal data on the asset, criticality, known exploitation and EPSS, with due dates set from it.
Evidence store
Every item hashed with SHA-256 and encrypted per organisation, with validity dates and version history. One item can support several controls, and integrity is checked on every download.
Tamper-evident audit trail
Every action is written to a hash-chained trail that you can verify from the product at any time, and that the platform checks every day.
India first, every framework on one set of evidence
Activate the frameworks you need. One control library serves them all, so the evidence you collect for the DPDP Act also counts towards ISO 27001, SOC 2 and the rest.
| Framework | What you get |
|---|---|
| DPDP Act 2023 and DPDP Rules 2025 | Active by default. Controls mapped to sections and rules, with applicability from your profile, including Significant Data Fiduciary duties, and future obligations shown as readiness. |
| CERT-In Directions 2022 | Active by default. Six-hour reporting, 180-day logs in India, NIC/NPL time sync, point of contact and sector-specific record keeping. |
| ISO 27001:2022 | Annex A posture from shared controls, with a Statement of Applicability ready for your certification body. |
| SOC 2 | Trust services criteria posture and evidence for your auditor. |
| NIST CSF 2.0 | Function and category posture for security programmes and US customers. |
| GDPR | Controller obligations by article, for organisations serving people in the EU or UK. |
| PCI DSS 4.0.1 | Requirement groups for organisations that store, process or transmit card data. |
Requirements are described in TrustNiq's own paraphrases, not the official texts. Requirements that no control tests show as not covered, a gap to close or exclude, never as a pass. Frameworks other than the DPDP Act, DPDP Rules and CERT-In are add-ons: Growth includes two and Enterprise all of them.
Setup wizard
Answer questions about your sector, size, customers and data, and get a recommended set of frameworks with the reason for each.
Unified and custom controls
Add your own controls and mappings. Attested controls are labelled apart from tested ones.
Library updates
The control library is versioned. You see exactly what changed for your active frameworks, and an approver records the review.
Gap analysis
Every requirement that fails, is unknown or is not covered, prioritised with a next step. Runs are kept, so you can compare them over time.
Gap tasks
Turn gaps into owned tasks with due dates and priorities, linked to requirements, controls and findings.
Statement of Applicability
Applicability, justification, status and owner per requirement. Exclusions need an approver. Claims that go beyond the evidence are flagged. Issue a frozen, hashed version.
Policy library
Versioned policies with maker-checker approval, review dates, the controls they support and acknowledgement tracking by audience.
Risk register
Risks from failing tests or entered by people, rated by likelihood and impact, with treatment, owner, review date and approved acceptance.
Audit-ready without the scramble
Audit workspace
Run internal, external, certification, surveillance or regulatory audits. Scope is frozen when fieldwork starts. Auditors send evidence requests, draw reproducible samples, raise observations and sign off. The final report is kept as hashed evidence.
Board pack
A PDF of headline figures and trends, top risks, findings needing attention, privacy operations, incidents and evidence health, generated from live results and saved as evidence of what was presented.
Audit evidence package
A ZIP of controls, test results with their evidence, findings, exceptions and the audit trail for the period, with a hash-chain check and a SHA-256 manifest. Crosswalk exports per framework.
The daily work of the privacy office
Notices
A versioned notice register, compared with what is actually processed so that undisclosed data shows as a mismatch.
Consent ledger
Who agreed to what, under which notice and when. A withdrawal creates a confirmation task for every downstream system and processor.
Rights requests
Access, correction, erasure, nomination and grievance on the 90-day clock. Identity is checked first, and erasure is verified against the source system.
DPIAs
Started from live risk indicators, approved by someone other than the author and kept as evidence with a review date.
Clocks that start the moment you record an incident
Record an incident with the affected systems or identities. TrustNiq works out the personal data and processors involved and starts the CERT-In six-hour and DPDP 72-hour clocks.
What you get on each incident
- Personal data impact and downstream processors
- Regulatory obligations and their deadlines
- A draft CERT-In incident report
- Draft Board intimation, detailed 72-hour report and notice to affected people
- A timeline of who did what and when
Drafts are pre-filled and gaps are marked. People submit reports and record when they did so.
Prove it to customers, check it with suppliers
Vendor reviews
Upload a DPA, contract or certificate. Processor clauses, breach notice windows and expiry dates are extracted with the page they came from, and confirmed by a person.
Vendor evidence requests
Send a vendor an expiring link to upload what you need, with no account required. Uploads go through the same review.
Security questionnaires
Import a customer's questionnaire and get suggested answers from approved past answers and current control results. "Yes" is only suggested when the evidence supports it.
Trust portal
A public page showing controls only while they pass, framework coverage and documents, with NDA-protected downloads you approve.
Govern AI use, and use AI safely
Keep an inventory of AI systems with an approval status, and find AI services in use without approval from proxy logs and from apps granted access in your identity provider.
TrustNiq's own AI features are off until an administrator approves a provider for a specific purpose: Anthropic Claude, OpenAI, Groq, xAI or a local model through Ollama. You can restrict your organisation to local models only.
Where AI helps, and its limits
- Answering questions from your evidence, with checked references
- A second reading of vendor contracts, kept only when the quote is found word for word
- Draft DPIA text and gap analysis summaries, labelled as drafts
- A second opinion on uncertain data classifications, from masked shapes only
- Never deciding a status, and never trained on your data
Connects to the tools you already use
Connections are read-only. Connectors are in early access and are validated with each customer during onboarding.
Systems scanned
- AWS and Microsoft Azure
- Entra ID, Okta and Google Workspace
- GitHub
- PostgreSQL, MySQL and other relational databases
- Trivy, OpenVAS and Dependency-Track reports
Documents as evidence
- Google Drive
- OneDrive and SharePoint
- Confluence Cloud
- Refreshed as evidence when a document changes at source
Work and alerts
- Jira and ServiceNow tickets for findings
- Slack, e-mail and signed webhooks
- Deadline reminders and escalations
- API keys for consent and rights request intake
Built for teams, auditors and enterprises
Roles
Admin, DPO, CISO, engineer and read-only auditor, with maker-checker approval on sensitive decisions.
Sign-in
MFA by default, single sign-on with OpenID Connect or SAML 2.0, and SCIM user provisioning on Enterprise.
Regulatory change monitoring
Regulator updates matched to the requirements and controls they affect, reviewed and decided by your team.
Your data, your exit
Export everything at any time. On offboarding, data is deleted and a deletion certificate is issued.
Questions
Which frameworks does TrustNiq cover?
The DPDP Act 2023, DPDP Rules 2025 and CERT-In Directions are active by default. ISO 27001:2022, NIST CSF 2.0, SOC 2, GDPR and PCI DSS 4.0.1 can be activated from the framework library. One control library serves them all, so a control tested once counts towards every framework it maps to.
Are the framework texts the official standards?
No. Each requirement is described in TrustNiq's own short paraphrase and links back to the source. Standards such as ISO 27001 and PCI DSS are copyrighted by their publishers and should be obtained from them. Regulatory summaries stay marked for legal review until they are checked against the official text.
Do the GRC modules cost extra?
No. Policies, the risk register, gap analysis, the Statement of Applicability and the audit workspace are in every plan, including the trial. Frameworks beyond the DPDP Act, DPDP Rules and CERT-In are priced one at a time: Growth includes two, Enterprise includes all of them, and on Starter each is a monthly add-on. The trial lets you try them all.
Can we add our own controls?
Yes. Custom controls are assessed from attestations that an approver reviews, and are labelled attested so they are never confused with controls tested automatically on system evidence. Any control can be linked to any requirement for your organisation.
Does the AI decide whether we are compliant?
No. Statuses come from deterministic tests on evidence. AI is off until an administrator approves a provider for a specific purpose, and it only drafts, explains or answers questions from your own evidence, with references that are checked before they are shown.
See your compliance posture on your own systems
DPDP, CERT-In, ISO 27001, SOC 2 and more. Connect one cloud account and one identity directory in a 14-day trial. No card needed.